CVE-2019-10330: gitea Missing Authorization
Modified
AliasesGHSA-q98c-rqx7-7ghf
Published 31-05-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10330 is a high (CVSS 7.5) Missing Authorization vulnerability in gitea. EPSS estimates a 2.14% chance of exploitation in the next 30 days, higher than 81.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
2.14%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 31-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.14%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.14% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Gitea1 product
- gitea≤ 1.1.1
Jenkins project1 product
- jenkins gitea plugin1.1.1 and earlier
Org.jenkins-ci.plugins1 product
- gitea< 1.1.2
3 vendors · 3 products
References
5 links- www.openwall.com/lists/oss-security/2019/05/31/2Mailing ListX Refsource MLISTThird Party AdvisoryWEB
